How safe can be a iSCSI LUN with CHAP security

Although I don't use the iSCSI LUN feature myself, I believe that that CHAP authentication might not be enough to protect against theft.  It does authenticate the initiator (and optionally the target).  But since the thief has direct access to the LUN container, he might still be able to extract your data without using an initiator.

 

Since the LUN is block storage and is formatted by the client, you should be able to encrypt the LUN itself.  That would block direct data extraction (and any initiator would also need to know the encryption key).  You could combine that with CHAP.

 

---

Bob245 wrote:

 Before I upgrade to the OS6.x version (because I would like to have the encryption feature)

---

IMO this feature has limited value, because you need to keep a thumb drive with the encryption key near or in the NAS.  The thief likely will steal the key also, and could figure out what it is for.  At least you should assume that he will.

 

Operationally, you need to insert that key whenever you boot the NAS.  That includes cases where the NAS is rebooted when you install the firmware and when power is restored after a power loss.